Commit 737d194c authored by Sean McGivern's avatar Sean McGivern

Allow group reporters to promote labels

They can admin group labels anyway, we weren't checking the more specific
permission.
parent 8ce11fc3
......@@ -8,7 +8,7 @@ class Projects::LabelsController < Projects::ApplicationController
before_action :authorize_admin_labels!, only: [:new, :create, :edit, :update,
:generate, :destroy, :remove_priority,
:set_priorities]
before_action :authorize_admin_group!, only: [:promote]
before_action :authorize_admin_group_labels!, only: [:promote]
respond_to :js, :html
......@@ -161,7 +161,7 @@ class Projects::LabelsController < Projects::ApplicationController
return render_404 unless can?(current_user, :admin_label, @project)
end
def authorize_admin_group!
return render_404 unless can?(current_user, :admin_group, @project.group)
def authorize_admin_group_labels!
return render_404 unless can?(current_user, :admin_label, @project.group)
end
end
......@@ -64,7 +64,7 @@
%a.js-subscribe-button{ data: { url: toggle_subscription_group_label_path(label.group, label) } }
Group level
- if label.is_a?(ProjectLabel) && label.project.group && can?(current_user, :admin_group, label.project.group)
- if label.is_a?(ProjectLabel) && label.project.group && can?(current_user, :admin_label, label.project.group)
= link_to promote_namespace_project_label_path(label.project.namespace, label.project, label), title: "Promote to Group Label", class: 'btn btn-transparent btn-action', data: {confirm: "Promoting this label will make this label available to all projects inside this group. Existing project labels with the same name will be merged. Are you sure?", toggle: "tooltip"}, method: :post do
%span.sr-only Promote to Group
= icon('level-up')
......
---
title: Allow reporters to promote project labels to group labels
merge_request:
author:
......@@ -117,7 +117,7 @@ describe Projects::LabelsController do
let!(:promoted_label_name) { "Promoted Label" }
let!(:label_1) { create(:label, title: promoted_label_name, project: project) }
context 'not group owner' do
context 'not group reporters' do
it 'denies access' do
post :promote, namespace_id: project.namespace.to_param, project_id: project, id: label_1.to_param
......@@ -125,9 +125,9 @@ describe Projects::LabelsController do
end
end
context 'group owner' do
context 'group reporter' do
before do
GroupMember.add_users(group, [user], :owner)
group.add_reporter(user)
end
it 'gives access' do
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment